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Abstract 

Fourier states are multi-qubit registers that facilitate phase rotations 
in fault-tolerant quantum computing. We propose distillation protocols 
for constructing the fundamental, n-qubit Fourier state with error 0(2~ n ) 
at a cost of 0(n log n) Toffoli gates and Clifford gates, or any arbitrary 
Fourier state using 0(n 2 ) gates. We analyze these protocols with methods 
from digital signal processing. These results suggest that phase kickback, 
which uses Fourier states, could be the current lowest-overhead method 
for generating arbitrary phase rotations. 



1 Introduction 

Fault-tolerant quantum computing seeks to develop quantum information pro- 
cessors that are resilient to faults in any hardware component using quantum 
error-correction codes [l}[2]- Recent attention has focused on how to minimize 
the resource costs of essential quantum computing primitives, such as a "uni- 
versal" set of operations. Theoretical analysis has shown that there must be 
at least one operation required for universality but not natively supported by 
the quantum code (often called "non-transversal" ) [3j|4j . Under realistic device 
parameters, the resource costs of the creating non-transversal gates dominate 
the total overhead for achieving fault tolerance [H]-[9]. Therefore, choosing the 
appropriate non-transversal operations directly impacts resource costs for fault- 
tolerant quantum computers. 

Many investigations, including some involving this author, adopt a "simpler 
is better" approach to selecting which non-transversal gate completes the uni- 
versal set, so they focus on the single-qubit gate T = exp[i7r(7 — a z )/8], where 
I is identity [5 21 . Recently, Landahl and Cesare proposed using a family 
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of rotation gates that they label = exp[z7r0(7 — a z )/2 k+1 ], which includes 
Z-2 = T, in what they term "complex instruction set computing (CISC)" [22]; a 
similar approach was used as a subroutine in Ref. [5j . Instead of the T gate, we 



promote an alternative, the three-qubit Toffoli gate |2[|23 25 . As an aside, our 
results also allow one to implement the CISC proposal efficiently. Ultimately, 
the universal gate set is used to approximate quantum circuits needed in an 
algorithm. Toffoli gates are already preferred for arithmetic circuits [6 26 - 28 , 
but this work goes further to show that Toffoli is also efficient for arbitrary 
gates. 

Recent work has shown that any arbitrary gate can be efficiently approx- 



imated using an instruction set that includes the T gate 12 20 . It has also 
been shown that arbitrary gates can be efficiently approximated with phase 
kickback, which uses Toffoli gates, so long as one has a multi-qubit resource 
that we call a "Fourier state" (Ml. This paper completes the phase kickback 
method by showing how to construct the Fourier state efficiently. Moreover, 
we go further to argue that phase kickback can have lower resource costs than 
methods that use T gates; when this is true, one should consider using Toffoli 
as the non-transversal operation in fault-tolerant quantum computing. 
To give some context, a Fourier state of size n qubits is defined as 

h ik) ) = ^Y,e i2 ^ N \y), (1) 

where N = 2". Note that this is the sign convention of Ref. [2] and opposite of 
that in Ref. [14] . These states are eigenstates of the modular addition operator 
U m \x) = \x + l (mod N)): 

U (Sl \ 1 ^)=e-^ k ' N \ 1 M). (2) 

Using this property, a phase-rotation gate can be approximated using a Fourier 



state and an addition circuit, which is known as phase kickback 14 29 30 
This method can produce any rotation around the a z axis of the Bloch sphere 
in units of ir/2 n ~ 1 radians, so the precision required by a quantum algorithm 
determines n. A notable feature of phase kickback is that the register \^ k >) 
is preserved, which means it can be used repeatedly. Many implementations of 



addition circuits are known 26-28 , but the fault-tolerant preparation of Fourier 
states has received less attention. Kitaev et al. propose a scheme based on phase 
estimation [30], but this protocol suffers from two notable disadvantages. First, 
the resulting state has random odd k. Second, the protocol requires a 

Fourier transform, which requires phase rotations; since the purpose of phase 
kickback is to produce phase rotations, implementing the Fourier transform to 
produce the Fourier state requires an approximate, iterative procedure. This 
paper develops a fault-tolerant distillation protocol for producing the frequently 
used |7^ 1 - ) ) state with O(nlogn) gates from a finite set. We also give a related 
protocol for constructing any l^f 1 --^) using 0(n 2 ) gates. 

The circuit for constructing Fourier states is implemented in a fault-tolerant 
quantum computer that, owing to the constraints of error correction [llplfi], 



2 



has a limited set of gates. In what follows, we will denote Pauli operators 
by Z = er z , etc. Some gates require more resource overhead to produce than 
others. Gates in the Clifford group are generated by combinations of: Hadamard 
H = {1/V2){X + Z), phase gate S = exp[iw(I-Z)/4\, and CNOT, up to global 
phase that we ignore. In the set of "Clifford gates," we also include ancilla qubits 
intialized to |0) and measurement M z performed in the Z basis. We assume that 
any Clifford gate is economical in terms of resource cost and that non-Clifford 
gates (those outside the Clifford group) are the dominant cost. This assumption 
is justified by analysis showing that non-Clifford gates are substantially more 
resource intensive than Clifford gates [5T[9]. Nevertheless, a universal set of 
operations requires at least one non-Clifford gate, and we select Toffoli. Recent 
work shows that low-overhead constructions for the Toffoli gate exist, often by 



implementing low-fidelity T gates with subsequent error correction 24 25 



The recent analysis of resource costs in Refs. [7j-[9 24 indicates that pro- 
ducing a Toffoli gate with error 10 -12 requires comparable physical resources 
when using surface code error correction to producing a single T gate having 
the same error probability. Although Toffoli gates could be the more resource- 
efficient choice of non-Clifford gate, constructing quantum algorithms efficiently 
with Toffoli gates was not fully resolved (prior to this work) in situations where 
arbitrary phase rotations are required. A major consequence of this paper is 
that it completes the phase-kickback protocol by showing that the discrete set 
of Clifford operations and Toffoli gates can efficiently approximate any quantum 



unitary, which could replace constructions using T gates 11 12 16 20 . 

The paper is organized as follows. Section [2] presents a protocol for distill- 
ing the "fundamental" Fourier state |7^) from approximations produced using 
only Clifford gates. Section [3] analyzes the resource costs of the distillation pro- 
tocol, which we summarize here. Constructing an n-qubit |7^ 1 ^) state requires 
circuit width 2n + 0(1) qubits, circuit depth 0(n) gates, and 0(n log n) Tof- 
foli gates in total. Section [4] compares phase kickback to a competing method 
using T gates, which is relevant since the purpose of Fourier distillation is to 
complete fault-tolerant constructions for phase kickback. Section [5] outlines a 
protocol for distilling \^ k ^) with arbitrary k using 0(n 2 ) Toffoli gates. The 
paper concludes with a discussion of why the combination of these results and 
recent work in constructing Toffoli gates makes phase kickback a compelling 
approach to approximating arbitrary quantum gates with low overhead. 



2 Distilling the fundamental Fourier state 

The fundamental |7 ( - 1 ^) state of size n qubits is required for phase-kickback 
constructions for both single-qubit phase rotations and two-qubit, controlled 



phase rotations 14 . This state is also useful for constructing a quantum Fourier 



transform (or its approximate version) through a special form of phase kickback 



called quantum-variable rotation 14 . This section shows how to construct 
I7W) using a distillation protocol based on addition circuits. We generalize the 
method in a later section to distill 17^) for arbitrary k, but the special case of 
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k = 1 requires fewer quantum gates. 



2.1 Approximate fundamental Fourier state 

Any pure Fourier-basis state where N in Eqn. (JlJ is a power of 2 is separable into 
individual qubits. Using a general Z-axis rotation R z (4>) = exp[i7T0(7 — Z)/2], 
a Fourier state can be decomposed as 

| 7 (fe) ) = [R z (k7r/2°)\+)] ® [R z (kn/2 1 )\+)] ® [i? 2 (W2 2 )|+)] ® (• ■ •)• (3) 

The single-qubit state |+) = H\0) = (l/\/2)(|0) + |1)). Using Eqn. we can 
see that the quantum state 

|7«) = Z|+) ® 5|+) ® J|+) ® J|+) ® (. . .) (4) 

is an approximation of |7^ 1 ^) (denoted with tilde). Moreover, l^*- 1 ^) can be 
produced using only Clifford gates. The rotations of 7r/4, it/8, etc. in Eqn. (|3| 
that are omitted in Eqn. Q become exponentially close to identity (in gate 
fidelity) with increasing qubit index, so we approximate them with identity 
gates. This is the same justification behind neglecting small-angle rotations 
in the approximate quantum Fourier transform |31| . The fidelity between the 

approximate and ideal states is \ 7^)\ > 0.81 for all values of n. 

Each approximate state can be expanded in the orthonormal Fourier-state 
basis as 

N-l 

l7 (1) > = £ ail-yV), (5) 

3=0 

where the dominant term among the complex coefficients is ai , with magnitude 
|«i | 2 ~ 0.81 from above. We ignore complex phase because we always work in 
the Fourier basis, and our distillation protocol depends only on the magnitudes 
of the Fourier-basis coefficients. 



2.2 Distillation protocol 

Using two approximate l^ 1 -*) states, the distillation protocol is very simple. 
First, add one register to the other. Binary-encoded, mod-2™ addition given by 

U add \v}\w) = \v}\w + v(mod2 n )) (6) 



has been studied extensively [26-28 . Notably, many addition circuits use the 
Toffoli gate as the non-Clifford operation. In the Fourier basis, the addition 
circuit implements 

C/ ad d|7 (fe) )|7 (fe,) ) = h ik - k 'W k ' ] )- (7) 

As an aside, this is precisely phase kickback, where the Fourier index k' of 
the second register determines the quantum-variable rotation applied to the 
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Figure 1: Circuit for distilling Fourier states. Each Fourier state is a multi- 
qubit register, and only three qubits are shown, with the rest indicated by 
vertical dots. For clarity, this circuit shows the inputs as pure Fourier-basis 
states, but in actual distillation protocols, the inputs will be mixed states. The 
addition circuit shown in the dashed box would be decomposed into Clifford 
gates and Toffoli gates. The verification step is implemented with Hadamard H 
and computational-basis measurement M z on each qubit in the top register. 



first register (see Section 4.f of Rcf. 14 ). Second, measure the first register 



in the Fourier basis, and postselect the cases where the result is |7 < - - ) ). The 
resulting output has each of its Fourier-basis coefficients {au} weighted by the 
probability that both inputs to distillation were in the state. If both 

inputs had sizable overlap with a particular state, then the fidelity conditioned 
on successful distillation is concentrated to a higher magnitude, and probability 
of being in unwanted basis states is suppressed. 

The quantitative expressions for distillation success probability and projec- 
tion of output state into the Fourier basis are simple to derive. Let the two inputs 
to distillation have Fourier-basis coefficients {aj} and {a'j} as in Eqn. (|5]). The 
probability of measuring l^^) (i.e. distillation succeeds) is given by 

N-l 

-^success ^ \®y\ \®*y\ ' (^) 

The output register of distillation will have Fourier coefficients {bj} with mag- 
nitudes 

1 1 2 I > I 2 
n a, a'- 

|fr/= 'p ' J ' ■ (9) 

-^success 

These expressions mirror those of entanglement distillation 32 , 33 . We measure 
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the fidelity of the output state as F = \bi\ 2 , and the error probability in the 
distilled state is e = 1 — F. 

A general Fourier-basis measurement would pose a problem because it re- 
quires operations outside the Clifford group, but we show how to circumvent 
this issue with Clifford gates. Since the quantum computer only supports 
computational-basis measurements, we would require a quantum Fourier trans- 
form (QFT) to map between the bases. This is essentially the obstacle encoun- 



tered by the Kitaev-Shen-Vyalyi protocol 30 , which addresses the matter with 
an iterative procedure of approximate QFTs. However, our distillation protocol 
does not require a complete Fourier-basis measurement; instead, we only need 
to know if the first register is in state |7^). This state happens to be the ten- 
sor product of |+) states, which are eigenstates in the X-basis. Hence, we only 
require application of the Hadamard gate H followed by measurement M z on 
each qubit in the first register in Fig. [I] If each qubit is the |+) state, then the 
register was projected into |7^), and distillation succeeds. Otherwise, reject 
the output and attempt again. Since H and M z are in the Clifford group, they 
are considered inexpensive to produce relative to the preceding non-Clifford ad- 
dition circuit. In addition to preparing the specific state |7^) (as opposed to a 
random Fourier-basis state [14 , 30 ), this measurement trick is how our protocol 



improves on the method in Ref. [30 

M 1 ^ frnm Enti tfipn In , I 2 = In.'. 1 2 



If the two input states are both \^ ') from Eqn. (WL then \a,j\ = \a'j\ for 

2 I 1 2 — 

all j. In general, when the inputs satisfy \aj\ = |a^| for all j, we say the distil- 
lation is "symmetric." The success probability is P SUCC ess — J2^=o \ a y\ 4 ~ 0-^7 
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where the coefficients {ctj} can be calculated using the method in Section 
The Fourier-basis weights of the output state are \bj\ 2 = \aj\ 4 /P succcss . The 
fidelity F = | fox 1 after one round of distillation is upper-bounded by 0.986, so 
multiple rounds of distillation are needed to reach arbitrarily high fidelity. This 
bounded fidelity also means that early rounds of distillation can use fewer than 
n qubits to represent the intermediate Fourier states, as we explain in Section[3j 
before explaining that technique, we must quantify the fidelity in each round. 

We define an n-qubit, m-round distilled \jm ) Fourier state as having "suf- 
ficiently high fidelity" if its fidelity with the pure Fourier state satisfies 

1-|<7^ |7 (1) )| 2 <sin 2 (V2"). (10) 

Subscript denotes how many rounds of symmetric distillation have been success- 
fully applied, so initial state |7^) = |7o )■ In phase kickback, the constraint in 



Eqn. ([10]) represents the highest accuracy that is needed. When the |7m^) reg- 



ister is used for phase kickback, there arc two sources of error that we consider 
here. The first is that the register |7m ) is not pure, meaning it has non-zero 
overlap with some other Fourier basis state. The second error source is that 
any phase rotation is truncated to n bits of precision. As a result, the trun- 
cated angle error is at most 7r/2 n radians, which results in an upper bound on 
the rotation-gate error probability of sin 2 (7r/2 n ) (tt/2") . In phase kickback 
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Figure 2: Symmetric distillation of Fourier states, where two rounds are shown. 
The approximate initial states are defined in Eqn. Q. Each distillation step 
is implemented using the quantum circuit in Fig. ffl Distillation is proba- 
bilistic, and when a distillation circuit fails, that circuit and preceding steps 
that feed into it must be repeated. The probability of failure decreases super- 
exponentially in round number, so the overhead of distillation failure is bounded. 

using an n-qubit \"fm^) state, the combination of the two errors means that any 
resulting rotations are accurate to ±7r/2^™ _1 ) radians, or at least (n — 1) bits. 
Ultimately, n is chosen based on the gate-accuracy requirements of the quantum 
algorithm. We arbitrarily choose to balance the error from a noisy ) with 
the worst-case truncation-of-angle error. If \ jm^) is used for other applications, 
such as complex-instruction-set quantum computing [22| , a different accuracy 
may be required. 

The first round of distillation will produce a Fourier state accurate to about 
5 bits. To construct an n-qubit Fourier state, we develop a distillation protocol 
consisting of multiple rounds of symmetric distillation. The symmetric distil- 
lation subroutines are arranged in a binary tree, as shown in Fig. [2] Multiple 
low-fidelity |7q ) input states are distilled to arrive at a single output state, 
|7r 1 ' 1 ). Subscript r is the number of rounds of symmetric distillation, or the 
depth of this binary tree arrangement. Choosing r depends on the desired num- 
ber of precision qubits n in the Fourier state. In the next section, we show that 
r scales as O(logn). 

2.3 Fourier analysis and distillation efficiency 

The distillation protocol can be understood by viewing probability amplitudes 
of the input state in the computational basis as discrete samples in time of a 
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function f(t) = e l2 ™^ such that l^) = J2y=o fi.v/ N )\v)- In this picture, the 
probability amplitudes of the quantum state in the Fourier basis are related to 
Fourier-series coefficients {cj} given by 

oo 

/(*)= E c ^ jt - ( n ) 

k— — oo 

The correspondence exists because a quantum Fourier transform maps between 
computational and Fourier bases. The number of "samples" is N = 2™, the num- 
ber of computational basis states. Discrete sampling causes aliasing according 
to the Shannon-Nyquist Theorem, so Fourier-basis probability amplitudes {aj} 
are related to the Fourier series of f(t) by 

oo 

a J = E c (Nx+j)- (12) 

X — — oo 

If N is sufficiently large (e.g. n > 6), then aj ps cj for < j < N/2 or 
a {N+j) ~ c j f° r —N/2 < j < 0, because the coefficients Cj decay in magnitude 
asymptotically as \cj\ 2 oc 1/j 2 , which means the error from neglecting aliased 
frequencies is suppressed exponentially in n. This asymptotic upper bound 
follows from Parseval's theorem for any signal that is square-integrable over its 
period, a condition which corresponds to normalized quantum states. 

In each approximate l"^ 1 " 1 ) register, the first qubit is the most significant 
bit in a binary encoding of equally-spaced time coordinates for samples of f(t). 
By using only Z and S rotations, we are effectively discretizing the phase of 
f(t) = e l2 ^ u ^ to two bits of precision as a piecewise-constant function over four 
equally-sized intervals in the domain t £ [0, 1). We can readily calculate the j th 
Fourier series coefficient of this function: 



c, 



1 

e i2ir(u(t)-jt) dt 


4 nm/i 

^•/(m-l)/4 
4 



771 — 1 



2ttj 



which is valid everywhere except j — 0, in which case Cq = 0. Sign convention 
follows Eqn. ([lj . The only nonzero terms occur for j = 1 (mod 4) , and they are 
cj = (2 — 2i)/(7rj). The squared magnitudes of the largest Fourier components 
for state |7q^) are plotted in the spectrum in Fig.jiJ The expression for Fourier- 
series coefficients allows us to derive bounds on distillation performance and 
hence the necessary number of rounds of distillation. For example, since there 
is no relative phase between these coefficients, initial Fourier states have |ai| 2 > 
|ci| 2 , where |ci| 2 =8/ir 2 . 
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Figure 3: Frequency spectrum of f(t). The height of a bar at j corresponds to 
the squared magnitude |cj| 2 , where {a,} are Fourier-series coefficients of f(t). 



Eqn. (12) relates these series coefficients to Fourier-basis amplitudes. 
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The output state of the distillation protocol, conditioned on success, has 
modified Fourier components. In symmetric distillation, the relative magnitude 
of each component to the fundamental harmonic is squared. After normaliza- 
tion, the largest component at j = 1 is amplified, while the rest are suppressed. 
The second-largest component is the "sideband" at j = —3 in Fig. [3j Note that 
because of aliasing in the frequency spectrum, C(_ 3 ) maps to a^ N _ 3 y, we assume 
that Fourier-series term C(n_3) is negligibly small. 

Distillation proceeds until the sidebands are suppressed to a sufficiently low 
level. The rate at which these sidebands are suppressed dictates how many 
rounds of distillation are required, which determines the total number of gates 
in the protocol. This rate is limited by the ratio in magnitudes between the 
fundamental j = 1 harmonic and the second-largest sideband at j = —3. This 
behavior is analogous to the rate of convergence in Markov-chain Monte Carlo, 
which depends on the magnitude of the second-largest eigenvalue of the state 
transition matrix (the largest eigenvalue of a stochastic matrix is 1). Success- 
ful symmetric state distillation through r rounds modifies each Fourier-basis 

(r) 

amplitude from aj to m according to 



(r) 



2 _ 1 
- C 



|2 



(14) 



where 

N-l 



3=0 

is the normalization. Since any sidebands to the fundamental harmonic (j = 1 
in this case) will be suppressed super-exponentially in r, we need to only focus 
on the magnitude of the largest sideband at ct-3), which will dominate the error 

in the output of distillation. As a result, the error e = 1 
the distilled Fourier state is closely approximated by 



7& 5 I 7 (fc) 



^(h- 3 )| 2 /N 2 ) ■ (16) 

I 1 2 2 

Consequently, the ratio C(_ 3 ) /\c\\ =9 (exactly) dictates how fast error is 
suppressed through distillation. Since we require that e < (7r/2™) 2 , we can 
determine the number of rounds of distillation as 

2n — 2 log 2 7r 



R 



log 2 



l0g2(|ci| 2 /|c ( -3)| 2 ) 



(17) 



This expression can be simplified to R = [log 2 (0.63n — 1.04)] (approximately), 
which shows that R scales as O(logn). Moreover, Eqn. |l6]) shows that the 
error at the output of each successive round of distillation is squared. Eqn. ( [To| 
shows that the number of qubits needed to represent an approximate Fourier 
state is O(loge), so the smallest allowable size in qubits of intermediate distilled 
states will double after each round. The next section uses this technique to save 
resources. 
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3 Resource analysis for distilling the fundamen- 
tal Fourier state 



This section shows that distilling the fundamental n-qubit Fourier state is effi- 
cient in the sense that it requires at most 0(n log n) Toffoli gates and total gates, 
with circuit width 2n+0(l) qubits. After each round of distillation, the number 
of bits of precision in the Fourier states doubles, so we also double the number 
of qubits going into the next round. The procedure is: (a) after one round of 
distillation, each Fourier state is accurate to s qubits; (b) append s more qubits 
in the |+) state to each register; (c) repeat distillation on the input states of size 
2s qubits. The additional error of making a larger approximate Fourier state 
by appending s qubits in the |+) state is less than the error already present, so 
the fidelity is not reduced appreciably. The extra qubits provide space for the 
output state of distillation (if it succeeds) to contain twice as many accurate 
qubits. 

Each round of distillation on s-qubit registers uses addition circuits that each 
require (2s — 4) Toffoli gates [26] (note that the carry-out Toffoli is unnecessary 
and removed). If there are R rounds of distillation, then the r th round requires 
2(fl-r) g^er circuits. If we begin with s qubits per Fourier state going into the 
first round and double the number of qubits in each subsequent round, then the 
total number of Toffoli gates in the entire distillation protocol is 



R 



C Tol = J2 2 (fl - r) (2 (r+1) s - 4) = 2^ R+1 '>Rs - 2(«+ 2 ) + 4. (18) 

r=l 

Since R scales as 0(log n), then Cr f scales as 0(n log n). We use s — 5 since the 



output of the first round is accurate to about 5 bits of precision. Eqn. ( 17) gives 
an exact expression for R. Fig. [4] plots the number of Toffoli gates required 
for distillation up to n — 100 bits of precision, which is the most precision 
one could imagine needing for a quantum algorithm. For example, 10 bits of 



precision is more than sufficient for 4096-bit Shor's algorithm 34 . In this case 
the approximately 100 Toffoli gates needed to distill are negligible in 

comparison to the rest of the algorithm [6] . We emphasize that even if multiple 
copies of a Fourier state are required, the distillation need only be performed 
once. Fourier states of size n qubits can be cloned using a single adder circuit 
requiring (2n — 4) Toffoli gates. 

The last round of distillation uses n + 0(1) qubits for each input register, 
which may be less than 2(- R ~ 1 )s. The additive constant appears because one 
might need to distill to (n+1) or (n+2) qubits in the final output, compensating 
for errors introduced by truncating the size of Fourier states in earlier rounds. 
Each round of symmetric distillation doubles the number of qubits per Fourier 
state, but the number of Fourier states is reduced by half. Consequently, the 
circuit width of the protocol is at most 2n + 0(l) qubits, because the final round 
uses two registers of size n + 0(1) qubits. 
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Figure 4: Expected number of Toffoli gates consumed in the distillation of an 
n-qubit Fourier state. Uncertainty in number of Toffoli gates is a result of 
distillation success being probabilistic in each round. No other non-Clifford 
gates are required, and the Toffoli gates dominate the cost of the adder circuits 
within distillation. 
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4 Resource comparison for approximating rota- 
tion gates 

One of the main reasons to distill Fourier states is that they facilitate fault- 
tolerant phase rotations with phase kickback [14] , so we determine the resource 
costs of this method and compare it to alternatives. Approximating an arbitrary 
phase rotation with error probability sin 2 (7r/2 n_1 ) requires an n-qubit, distilled 
Fourier state, including the residual error probability from distillation. As 
shown previously, preparing such a state requires O(nlogn) Toffoli gates, but 
this initialization need only be performed once. Each phase rotation uses an 
addition circuit, which requires at most 2n — 4 Toffoli gates [26]; however, one 
of the addends is a known value, so we can simplify the adder and "short- 
circuit" half of the Toffoli gates, replacing them with Clifford gates. In this 
special case, a single-qubit phase rotation with a precision of n/2 n ~ l radians, 
which is (n — 1) bits of precision, requires just (n — 2) Toffoli gates, n qubits for 
the Fourier states, and (n— 1) ancilla qubits for the internal carry operations of 
the adder. Forming controlled-rotation gates is simple as well. Each additional 
control input to the multi-qubit gate requires one more Toffoli gate and one 
more ancilla qubit. 

The best results for approximating single-qubit rotations with sequences of 



T gates and Clifford gates each require about 3 T gates per bit of precision 12 



20 . These methods require at most 2 ancilla qubits instead of (2rt — 1) for 



phase kickback, but the total resource costs from non-Clifford gates is higher. 



Reference 20 estimates the number of T gates is Ct — 3.21 log 2 (l/ep) — 6.93; 
gate-error ep is defined in Ref. 12 as 



ti(WU) , (19) 



where U is the fault-tolerant sequence approximating gate U. In the case of a 
phase kickback rotation accurate to p bits, the error would be 



e F = y 1 - \ |1 + cxp( i7 r/ 2P )| « ± ( J) , (20) 

where approximation is correct to at least four significant figures for p > 6. 
A phase kickback rotation accurate to p bits has the succinct error expression 
Iog 2 (l/e F )«p-0.15. 

We give direct comparison of resource costs in the two methods approximat- 
ing rotation gates. To construction a rotation gate accurate to p bits, one would 
require (in terms of non-Clifford gates) : 



• (3.21p — 6.45) T gates (on average) using an approximation sequence 20 
or 



(p — 1) Toffoli gates using phase kickback 14 . 
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One could produce a Toffoli gate using 4 T gates 24 25 , in which case approxi 



mation sequences and phase kickback have similar costs in terms of non-Clifford 
gates. However, efficient fault-tolerant constructions have been found for the 
Toffoli gate which further reduce the required resources to about the cost of a 



single T gate, or even lower 24 . Consequently, the total cost of non-Clifford 
gates is expected to be lower when using phase kickback. Given that the cost 
of either T or Toffoli is much greater than a Clifford gate or ancilla qubit (by 
about two orders of magnitude [7j[9]), there is considerable evidence that phase 
kickback is the current lowest-overhead construction for a fault-tolerant phase 
rotation. Further work is needed to develop explicit expressions for resource 
costs as a function of hardware parameters and the methods of error correction 
selected. 



5 Distilling arbitrary Fourier states 

We outline here a procedure for distilling any \^ k ' ) ) Fourier state, leaving the 
detailed analysis for future work. Arbitrary values of k are need for QVR phase 
kickback [14] , which is useful in quantum simulation and some implementations 



of the linear-systems algorithm algorithms 14 35 . Ref. |14| gives a method 
for transforming any n-qubit |7^) with odd k to any other |7^ fc 5), using 0(n 2 ) 
gates. Since it requires phase kickback with successively larger addition circuits, 
the number of Toffoli gates is 



E( 



(n-3)(n-2) , , 

s-2) = ^ g '-. (21) 



s=3 

That protocol is deterministic and does not requ ire d istillation, assuming one 



already has a Fourier state. The protocol in Sec. 2.2 could distill |7 < - 1 - > ), which 
could then be transformed into any \"f^). 

Approximations of any |7 ( - fe - ) ) can also be distilled using the protocol in Sec- 
tion [2]2] To have reasonably good efficiency, the approximate initial states need 
to have substantial fidelity with the desired pure state, say F > 0.5. There 
are at least two possible approaches. One is to start I7*- -') = |+)® n , then ap- 
ply QVR for each '1' bit in the binary representation of k, using a |7 < - 1 ^) state 
truncated to Oilogn) qubits. Each QVR gate need only be accurate to error 
O(2~ log ") = 0(l/n), as there are at most n such operations, so the aggregate 
error is of order unity, meaning we can bound it below 0.5. These approximate 
states are then distilled, but they are all of size n qubits, so the total number 
of Toffoli gates is 0(n 2 ). Whether this method is more efficient than the de- 
terministic construction is not yet clear. A second way to prepare approximate 
states is to split the quantum register encoding a desired Fourier state into two 
registers of roughly equal size, and first prepare these approximately through 
distillation. This method can be applied recursively until the input states are 
small, like the s = 5 starting state above. For the protocol in Section [3j many 
of the intermediate registers are |7^), which can be constructed with Clifford 



14 



gates; this will not always hold for arbitrary k, so the number of Toffoli gates 
needed here is higher than the distillation of \"/^} and may also be 0(n 2 ) for 
this method. Since Fourier states used for QVR phase kickback can be reused, 
the number of different values of k used by an algorithm will dictate whether 
seeking optimized state-preparation protocols is a worthwhile endeavor. 



6 Discussion 

Although we only use Z and S gates to initialize approximate Fourier states, 
one could also use smaller-angle magic states R z (n/2 X )\+) for x > 2, which 
would increase success probability and decrease the number of rounds. How- 
ever, this approach would require distillation of those small-angle magic states or 



approximation of the small-angle rotations 22 . Adding a low-fidelity T gate to 
produce a more accurate initial state might be advantageous, but dramatic im- 
provements using smaller-angle rotations are not expected for typical quantum- 
computing parameters. Conversely, Fourier states would readily enable the 



complcx-instruction-set computing of Ref. 22 , because each Fourier state is 
the tensor product of the desired small-angle magic states. Fourier states can 
be cloned with just (2n — 4) Toffoli gates using QVR phase kickback [M]. As 
such, phase kickback is a better way to produce these magic states than distilling 
them individually. 

Since recent circuit constructions have substantially lowered the cost of a 
fault-tolerant Toffoli gate [24|[25] , one should consider whether further improve- 
ments to T gates are possible. Reductions in T-gate cost could make approxi- 
mation sequences a better choice than phase kickback for approximating gates, 
and this comparison determines whether our results in Fourier-state distilla- 
tion are useful. We give two arguments for why substantial lowering of T-gate 
costs is unlikely. First, magic-state distillation for T gates places considerable 
constraints on the underlying quantum codes. It has been conjectured that a 
protocol distilling states from error e to 0(e d ) yields an output/input distilla- 
tion fraction less than l/d [18], and the only known codes that approach this 
limit are so complicated as to make implementation impractical |19| . From this 
we infer that magic-state distillation for T gates cannot improve substantially 
unless a completely different method is discovered. Second, error correction for 
Toffoli gates is much more efficient by comparison, and there is further room 
for improvement. In the best Toffoli constructions, one uses T gates (at lower 
fidelity though perhaps distilled) inside an error-detecting circuit to suppress 
gate errors; with this approach, logical Toffoli is the only non-Clifford gate visi- 
ble to the algorithm. If the conjecture above were extended to resource costs for 



Toffoli gates, then the protocol in Refs. 24 25 saturates the limit through one 



round, which is why a Toffoli gate costs about the same resources as a T gate 
with current methods; further improvements are expected to reduce the cost of 
a logical Toffoli gate below that of a logical T gate. 

Recent work suggests "V-basis" rotations may also be efficient at approxi- 



mating arbitrary rotation gates 36 37 . These non-Clifford gates can be gener- 
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atcd from a distillation procedure that uses T gates 36 . Further work is needed 
to determine the fault-tolerant resource costs of V-basis methods and how these 
costs compare to those of phase kickback or other methods. 

By demonstrating how to distill Fourier states and hence complete the phase 
kickback protocol, this paper has two broader implications. (1) Quantum com- 
puting with only Clifford and Toffoli gates is efficient, and simple constructions 
for arbitrary gates are known. (2) Quantum algorithms using an instruction set 
of (Clifford-I- Toffoli) gates could require fewer resources than those using an in- 
struction set of (Clifford+T) gates, so the Toffoli gate deserves serious attention 
as the non-Clifford operation in fault-tolerant quantum computing. 
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